Lesson 4.3: Patching, backups and logging: the boring controls that save you
Most breaches use known holes that already had a fix, and most disasters are survived by whoever had a backup they had actually tested. Patch management, the 3-2-1 backup rule, restore tests, and why logs must be kept and protected. In the lab you find and install a security update, make a backup of a project with a checksum, restore it somewhere else and prove it is identical, and read today's logs of the SSH service.
19 min
You will learn to
- Explain patch management and why speed matters
- Find and install a pending security update with apt
- Explain the 3-2-1 backup rule
- Make a backup, record its checksum and prove a restore is identical
- Read a service's logs with journalctl
Key terms
- Patch
- An update that fixes a bug or a vulnerability.
- Patch management
- The routine of finding, testing and installing updates on every system, fastest for the most dangerous ones.
- Backup
- A copy of data kept apart from the original, so it can be restored after loss, damage or ransomware.
- 3-2-1 rule
- Keep 3 copies of important data, on 2 different kinds of storage, with 1 copy off-site or offline.
- Restore test
- Actually restoring a backup somewhere and checking the result.
- Log
- A time-stamped record of events written by a system or program.
← Wildcards and path expansion · All lessons · More ways to look at text: head, tail, wc, sort and uniq →